[NEW] Setting to block unauthenticated access to avatars#9749
[NEW] Setting to block unauthenticated access to avatars#9749sampaiodiego merged 10 commits intoRocketChat:developfrom
Conversation
|
This looks good to me. @rodrigok thoughts on this being enabled by default? Should this be a setting or just default? |
|
Looks like this will break mobile apps. We need to get them on track to passing authentication along before we put this in a release. |
graywolf336
left a comment
graywolf336
left a comment
There was a problem hiding this comment.
I like this option, however it does break how everything currently accesses the avatars. So, how about we add a new setting (yes another one) that defaults to false and then after three releases we make it enabled by default? Then if the NODE_ENV is something other than production, let's log a warning every thirty minutes or so after it's been accessed (so it's not spammy)...or we can somehow notify developers/admins that avatars will soon be protected?
|
agreed on adding a setting for that, just like we have for file uploads. agreed as well on a throttled log on server saying avatars will be protected after three releases if the request does not have any authentication |
sampaiodiego
left a comment
sampaiodiego
left a comment
There was a problem hiding this comment.
@Hudell can you please do the requested changes? thx
…Hudell/Rocket.Chat into block_unauthenticated_access_to_avatars
Hudell
dismissed stale reviews from graywolf336 and sampaiodiego
Changes were made
sampaiodiego
changed the title
6 participants
@RocketChat/core
Closes #3480